Se the attached screenshot for a bug in such status.
The change status control is not showed.
The status may be changed by group actions though, as that shows all status (regadless of workflow settings)

So one issue, is that the status selector should be available, according to current logic.

A secondary issue, but no less important:
There is no way to configure a status that has no valid transitions.

regarding defaults:
"By default, there is no workflow defined, which means that all states are accessible from any other, by anyone."

This is from config_defaults_inc
$g_status_enum_workflow = array().

Note this inconsistency again:
manage_config_workflow_page.php, for the default array(), shows all status checked. If saved, a local config is created with the filled matrix, even if no change is made.

I suggest setting this semantics:
1) IF status_enum_workflow == array() RETURN true
This means all transitions are valid, to keep this default working.

2) If any row is not set
Keep this check, for the case where new status are introduced, and still not updated in the config matrix
<pre>
if ( !isset( $t_status_enum_workflow[$p_bug_status] ) ) {
return true;
}
</pre>

However, manage workflow page should show this case as a row with all status checked, same logic as (1)

3) make the workflow config save an empty array if no status are checked, so tha:
there exists a row $t_status_enum_workflow[$p_bug_status] (which is empty)
MantisEnum::hasValue( $t_allowed_states, $p_wanted_status ) returns false naturally

I have tested that hardcoding status_enum_workflow[STATUS] = ''
works in my expected way, where no transitions are allowed

Related Changesets

Fix several inconsistencies with the treatment of status_enum_workflow
configuration.

1. Fix showing a non existant status row in workflow config array. This
is interpreted as if that status allows all transitions, but in the
config page, the checks were shown unmarked, which can be confusing.
Now the checks appear marked in this situation.

2. As consequence of (1), the message "You cannot move an issue out
of this status" is not show anymore in that situation.

3. When a status row is saved with all transitions unchecked, an empty
enum string is saved, meaning effectively that no transitions are
allowed from that status. This specific configuration was previously
unavailable from the workflow config page.